Examkin

Question

Difficulty: MediumAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline to deploy a containerized application to Amazon ECS. The application requires access to a database password that must be rotated automatically every 30 days. The pipeline must deploy the new version to ECS with zero downtime, using a secure method to supply the database password to the container without exposing it in plaintext in the pipeline artifacts or source code.

Which configuration should the developer implement?

  1. Store the password in AWS Secrets Manager with automatic rotation enabled. In the Amazon ECS task definition, reference the secret using its ARN in the secrets section. Use AWS CodeDeploy within CodePipeline to perform a Blue/Green deployment for the ECS service.Answer
  2. B
    Store the password as a SecureString parameter in Systems Manager Parameter Store with automatic rotation enabled. In the CodePipeline build stage, retrieve the parameter and pass it as an output artifact to the ECS deployment stage. Use AWS CodeDeploy to perform a Canary deployment.
  3. C
    Store the password in AWS Secrets Manager with automatic rotation enabled. Update the ECS Task Execution Role's trust policy to allow the secretsmanager.amazonaws.com service principal to assume the role. Reference the secret ARN in the task definition environment variables. Use AWS CodeDeploy within CodePipeline to run a Blue/Green deployment.
  4. D
    Store the password in AWS Secrets Manager with automatic rotation enabled. In the CodePipeline source stage, add the password directly to the container environment variables in the AppSpec file. Use AWS CodeDeploy within CodePipeline to perform an All-at-Once deployment to replace the running ECS tasks.

Answer

Store the password in AWS Secrets Manager with automatic rotation enabled. In the Amazon ECS task definition, reference the secret using its ARN in the secrets section. Use AWS CodeDeploy within CodePipeline to perform a Blue/Green deployment for the ECS service.
The correct answer correctly identifies AWS Secrets Manager as the appropriate service for credentials requiring automatic rotation. It correctly uses the ECS task definition 'secrets' section to securely inject the secret into the container at runtime, and uses AWS CodeDeploy Blue/Green deployment to ensure a zero-downtime deployment.

Step-by-Step Solution

1
Store and secure the secret
The database password is saved in AWS Secrets Manager, and automatic rotation is configured for every 30 days.
Secrets Manager natively supports automatic rotation, meeting the requirement, while Systems Manager Parameter Store does not.
2
Configure ECS task definition integration
The ECS task definition references the Secrets Manager ARN in the 'secrets' parameter, rather than placing it in plaintext environment variables.
This enables the ECS agent to securely retrieve the password and inject it into the container at launch time without exposing it in the pipeline definition.
3
Define the deployment strategy in CodePipeline
A Blue/Green deployment is set up using AWS CodeDeploy as a deploy action in CodePipeline.
A Blue/Green deployment provisions a new task set and routes traffic traffic incrementally or all-at-once to the new tasks, ensuring zero downtime and providing an automated rollback path if the deployment fails.

Key Concept

AWS CodePipeline integration with ECS and AWS Secrets Manager for secure container deployment.
Rate this question

Topics

AWS CodePipeline

More questions from this topic